diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2cd778df9..d34d28c3d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -337,6 +337,9 @@ jobs:
       - name: Native-readiness roadmap policy gate
         run: pnpm run native-readiness:check
 
+      - name: Tauri plugin Rust/npm version-parity gate
+        run: pnpm run tauri-plugins:check
+
       - name: Feature parity audit
         run: pnpm run parity:check
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0114ce434..b350f0ef7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **Tauri plugin Rust/npm version parity restored:** `tauri-plugin-http` and
+  `tauri-plugin-notification` had drifted ahead of their npm counterparts
+  (`@tauri-apps/plugin-http`, `@tauri-apps/plugin-notification`) after #661 bumped only the Rust
+  side, failing every platform's Tauri release build. Bumped the npm packages to match; added
+  `check-tauri-plugin-versions.mjs`, a cheap CI guard catching this class of mismatch before the
+  next release tag instead of at tag-triggered release time.
+
 <!-- release-candidate: v1.28.5 -->
 ## [1.28.5] — 2026-09-09
 
diff --git a/README.md b/README.md
index 97ddc9775..ac00f4ae3 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@
   <img src="https://img.shields.io/badge/Storage-IndexedDB_v8-F59E0B" alt="IndexedDB v8">
   <img src="https://img.shields.io/badge/PWA-v3.0-5BB974?logo=pwa" alt="PWA v3.0">
   <img src="https://img.shields.io/badge/i18n-19_locales-2942_keys-0EA5E9" alt="i18n 19 locales — 2942 keys">
-  <img src="https://img.shields.io/badge/Tests-7635%2B_%2F_603_files-22C55E" alt="7635+ tests / 603 files">
+  <img src="https://img.shields.io/badge/Tests-7643%2B_%2F_604_files-22C55E" alt="7643+ tests / 604 files">
   <img src="https://img.shields.io/codecov/c/github/qnbs/WorldScript-Studio?logo=codecov&label=Coverage" alt="Codecov Coverage">
   <img src="https://img.shields.io/badge/License-MIT-22C55E" alt="License MIT">
   <img src="https://img.shields.io/github/actions/workflow/status/qnbs/WorldScript-Studio/.github/workflows/ci.yml?branch=main&logo=github" alt="CI Status">
@@ -512,7 +512,7 @@ The Settings → AI panel shows a live GPU status badge with adapter details and
 | **Document Export**  | docx + jszip                                              | Word-compatible `.docx` generation (lazy-loaded)                     |
 | **PWA**              | Service Worker + Web App Manifest v3                     | Offline support, installability, Workbox chunking                    |
 | **i18n**             | Custom React Context (`I18nContext.tsx`)                  | 2942 keys × 19 locales (de/en/es/fr/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu/ru/ko Beta); EN fallback; `localStorage` persistence |
-| **Testing**          | Vitest 4.x (7635+ tests / 603 files) + Playwright E2E     | Unit/integration + cross-browser E2E; Stryker mutation (manual workflow)          |
+| **Testing**          | Vitest 4.x (7643+ tests / 604 files) + Playwright E2E     | Unit/integration + cross-browser E2E; Stryker mutation (manual workflow)          |
 | **Code Quality**     | Biome (lint + format) + TypeScript 7 (tsgo) strict       | `--error-on-warnings` in CI; zero `any` policy                      |
 | **Visualization**    | Force-directed graph                                      | Interactive character relationship network                           |
 | **Desktop**          | Tauri v2                                                  | Cross-platform installer; auto-updater via `latest.json`             |
@@ -550,7 +550,7 @@ WorldScript-Studio/
 │   ├── sw.js             # PWA Service Worker
 │   └── manifest.json     # PWA Web App Manifest v3
 ├── tests/
-│   ├── unit/             # Vitest unit tests (7635+ tests, 603 files) — count spans tests/, components/, packages/*/tests/, not just this folder
+│   ├── unit/             # Vitest unit tests (7643+ tests, 604 files) — count spans tests/, components/, packages/*/tests/, not just this folder
 │   │   ├── ai/           # aiSmallModules, aiCoreFallbackPaths
 │   │   └── settings/     # WebLlmPanel, AiSections
 │   └── e2e/              # Playwright specs + helpers.ts
@@ -715,7 +715,7 @@ The main pipeline is [`.github/workflows/ci.yml`](.github/workflows/ci.yml). Opt
 Raw bundle-budget ceilings (KB per uncompressed asset): entry **2500 KB**, vendor **6200 KB**, other JavaScript **2500 KB**, and WASM **30000 KB**.
 
 **Current test metrics (2026-09-07, source-synchronized; CI remains authoritative for pass/fail):**
-- **7635+ unit tests** across **603 test files** — CI is authoritative for pass/fail
+- **7643+ unit tests** across **604 test files** — CI is authoritative for pass/fail
 - Coverage thresholds: lines ≥ 80 · branches ≥ 66 · functions ≥ 72 · statements ≥ 78 — enforced in CI (see Codecov badge for live metrics)
 - i18n: **2942 keys × 19 locales** (en/de/fr/es/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu/ru/ko Beta)
 
diff --git a/docs/CI.md b/docs/CI.md
index fd3f09d0b..b54e79a6c 100644
--- a/docs/CI.md
+++ b/docs/CI.md
@@ -375,7 +375,7 @@ the local block above; GitHub Actions owns those heavy checks on this hardware.
 
 `pnpm run ci:prepush` always resolves a change classification from the outgoing evidence first
 (`scripts/ci-prepush-classifier.mjs`), then runs docs/release-truth, CSP, desktop-import boundary,
-native-readiness, and dependency-state checks unconditionally on every invocation. It does **not**
+native-readiness, Tauri plugin version-parity, and dependency-state checks unconditionally on every invocation. It does **not**
 run Biome lint — full-repository lint stays CI-owned (`quality` job); only staged files are linted
 locally, by the separate pre-commit hook (`lint-staged`). Two check groups are conditional on the
 change classification instead of always running:
diff --git a/docs/PR-CI-MERGE-WORKFLOW.md b/docs/PR-CI-MERGE-WORKFLOW.md
index e5d810934..9a7ea1a33 100644
--- a/docs/PR-CI-MERGE-WORKFLOW.md
+++ b/docs/PR-CI-MERGE-WORKFLOW.md
@@ -2,11 +2,11 @@
 
 Full pre-push gate mechanics, worktree bootstrap, CI pipeline order, the PR review-comment correction loop (bot roster, three-channel comment check, quiescence loop), and known GitHub merge-gate quirks with recovery steps. The short list of non-negotiable rules distilled from this doc lives in the root `AGENTS.md`.
 
-**Mandatory pre-push gate:** Run `pnpm run ci:prepush` before every push and again after every local correction before re-pushing. It always resolves a change-aware classification (`scripts/ci-prepush-classifier.mjs`) from the outgoing evidence first, then runs docs/release-truth, CSP, desktop-import-boundary, native-readiness, and dependency-state checks unconditionally — it does **not** run Biome lint; that stays the pre-commit hook's job on staged files only (`lint-staged`), and full-repository lint is CI-owned. The single-checker (`--checkers 1`) local typecheck and the i18n/content-guard checks run only when the classification requires them — `DOCS_ONLY`, `WORKFLOW_ONLY`, `NON_CODE_ONLY`, `RUST_TAURI`, `TOOLING`, and non-TypeScript `TEST_ONLY` changes report typecheck as `DEFERRED_TO_REQUIRED_CI` instead of running it locally, and i18n/content-guard checks run only for changes matching their own governed paths or implementation files (see `scripts/ci-prepush-check-registry.mjs`). It is the same `tsgo --noEmit` check as CI, not literally identical to it — CI uses `--checkers 4`. Whenever outgoing path evidence is incomplete, unresolved, or the manual committed-range diff fails, the gate fails closed into full local admission (every conditional check runs) rather than deferring anything. A targeted test or changed-file lint run alone is insufficient. If pnpm reports a dependency verification failure after a branch or lockfile change, run `node scripts/dependency-state.mjs reconcile` (or `pnpm run deps:reconcile`) first, then rerun the gate. The pre-commit hook does not replace this gate. Required GitHub CI remains the unconditional authority for the complete lint, TypeScript, and i18n validation regardless of what the local gate deferred.
+**Mandatory pre-push gate:** Run `pnpm run ci:prepush` before every push and again after every local correction before re-pushing. It always resolves a change-aware classification (`scripts/ci-prepush-classifier.mjs`) from the outgoing evidence first, then runs docs/release-truth, CSP, desktop-import-boundary, native-readiness, Tauri plugin version-parity, and dependency-state checks unconditionally — it does **not** run Biome lint; that stays the pre-commit hook's job on staged files only (`lint-staged`), and full-repository lint is CI-owned. The single-checker (`--checkers 1`) local typecheck and the i18n/content-guard checks run only when the classification requires them — `DOCS_ONLY`, `WORKFLOW_ONLY`, `NON_CODE_ONLY`, `RUST_TAURI`, `TOOLING`, and non-TypeScript `TEST_ONLY` changes report typecheck as `DEFERRED_TO_REQUIRED_CI` instead of running it locally, and i18n/content-guard checks run only for changes matching their own governed paths or implementation files (see `scripts/ci-prepush-check-registry.mjs`). It is the same `tsgo --noEmit` check as CI, not literally identical to it — CI uses `--checkers 4`. Whenever outgoing path evidence is incomplete, unresolved, or the manual committed-range diff fails, the gate fails closed into full local admission (every conditional check runs) rather than deferring anything. A targeted test or changed-file lint run alone is insufficient. If pnpm reports a dependency verification failure after a branch or lockfile change, run `node scripts/dependency-state.mjs reconcile` (or `pnpm run deps:reconcile`) first, then rerun the gate. The pre-commit hook does not replace this gate. Required GitHub CI remains the unconditional authority for the complete lint, TypeScript, and i18n validation regardless of what the local gate deferred.
 
 **New-worktree / first-time dependency bootstrap — never a bare `pnpm install`:** When materializing `node_modules` for the first time on a new git worktree (or any branch checkout that hasn't been installed yet), always run `node scripts/dependency-state.mjs reconcile` (or `pnpm run deps:reconcile`) — never a bare `pnpm install`. The bare form omits `--frozen-lockfile`, so on any manifest/lockfile drift it silently *rewrites* `pnpm-lock.yaml` instead of failing loudly, and it never writes the repo's own dependency fingerprint (`node_modules/.worldscript-deps-fingerprint`) — that fingerprint is checked only by `pnpm run deps:verify`, `ci:prepush`, and the pre-commit hook, not by arbitrary `pnpm run <script>` calls, so a stale one from a bare install can go undetected until one of those three actually runs. Separately, pnpm's own built-in `verifyDepsBeforeRun` check (unrelated to this repo's fingerprint file; it compares `node_modules` against the lockfile) can independently surface a broader `node_modules`/lockfile mismatch on other `pnpm run` calls as `ERR_PNPM_VERIFY_DEPS_BEFORE_RUN`. This matters most exactly where it looks safest: on a branch that deliberately touches *nothing* dependency-related — a Dependabot GitHub-Actions-only bump, a docs-only PR, a workflow-policy fix — a stray unverified bare install is the one action that could introduce an out-of-scope `pnpm-lock.yaml`/`package.json` change nobody asked for, or run install/postinstall scripts against an unverified graph. `deps:reconcile`'s `--frozen-lockfile` failing loudly is the primary safeguard; after it succeeds, `git status --porcelain` / `git diff --stat -- pnpm-lock.yaml package.json` showing no diff is corroborating evidence, not a substitute for using the right command in the first place — a clean lockfile diff after a bare install proves the graph happened to already be in sync, not that the bare install was the correct or safe choice to make. **Name the worktree directory itself dot-free** (e.g. `release-v1282`, not `release-v1.28.2`) — see the `tsgo` gotcha under Build & bundler gotchas.
 
-**Quality gate (local pre-push subset):** `pnpm run ci:prepush` runs dependency-state/docs/CSP/native-readiness checks unconditionally (never full-repository lint — see the pre-push gate note above for what runs lint locally), and the single-checker local typecheck and i18n/content-guard checks only for changes the classifier marks as potentially impacting them (fail-closed to "run everything conditional" when evidence is incomplete); CI additionally runs full-repository lint, the 4-checker typecheck, full-suite coverage, and heavy jobs regardless of what the local gate ran. Locally use only the targeted form `pnpm exec vitest run <path> --coverage` when debugging coverage. Full pipeline graph: [`CI.md`](CI.md). Coverage thresholds: lines 80, branches 66, functions 72, statements 78 (see `vitest.config.ts`).
+**Quality gate (local pre-push subset):** `pnpm run ci:prepush` runs dependency-state/docs/CSP/native-readiness/Tauri-plugin-parity checks unconditionally (never full-repository lint — see the pre-push gate note above for what runs lint locally), and the single-checker local typecheck and i18n/content-guard checks only for changes the classifier marks as potentially impacting them (fail-closed to "run everything conditional" when evidence is incomplete); CI additionally runs full-repository lint, the 4-checker typecheck, full-suite coverage, and heavy jobs regardless of what the local gate ran. Locally use only the targeted form `pnpm exec vitest run <path> --coverage` when debugging coverage. Full pipeline graph: [`CI.md`](CI.md). Coverage thresholds: lines 80, branches 66, functions 72, statements 78 (see `vitest.config.ts`).
 
 **CI pipeline order:** `security` → `quality` (Biome + tsgo + Vitest matrix) → `build` / `e2e` / `storybook` (parallel) → `lighthouse` (after build) → `deploy` on `main`. `ci-success` is a required-status aggregator (`if: always()`) so branch protection can require one context instead of many individual ones — it fails if any governed required job doesn't resolve to `success` (Rust jobs and `pr-size` legitimately skip when their trigger conditions don't apply, and that counts as pass for that job only). The exact, current dependency list lives in [`CI.md`](CI.md#job-graph) and the live `ci-success` job in `.github/workflows/ci.yml` — don't hardcode it here, it changes as jobs are added or removed. Two additional jobs run in parallel with `quality`, both path-scoped via the `changes` job (legitimately `skipping` on PRs that don't touch their directory, which `ci-success` treats as a pass for that job only): `rust-tauri` (`src-tauri/**` — fmt/check/clippy/test, needs the GTK/WebKit apt-get steps) and `core-rust` (`crates/**` — same fmt/check/clippy/test for the renderer-neutral Rust Core, no GUI deps so no apt-get steps needed).
 
diff --git a/package.json b/package.json
index b92f2caee..dcfbcb844 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "deps:verify": "node scripts/dependency-state.mjs verify",
     "deps:reconcile": "node scripts/dependency-state.mjs reconcile",
     "ci:prepush": "node scripts/ci-prepush-lowend.mjs",
-    "ci:local:full": "pnpm run lint && pnpm run typecheck && pnpm run i18n:check && pnpm run guardrail:desktop-imports && pnpm run native-readiness:check",
+    "ci:local:full": "pnpm run lint && pnpm run typecheck && pnpm run i18n:check && pnpm run guardrail:desktop-imports && pnpm run native-readiness:check && pnpm run tauri-plugins:check",
     "predev": "node scripts/sync-csp.mjs && node scripts/sync-sw-version.mjs && node scripts/sync-tauri-version.mjs && node scripts/sync-readme-metrics.mjs && node scripts/build-i18n.mjs && node scripts/copy-duckdb-assets.mjs",
     "dev": "vite",
     "dev:turbo": "turbo run dev --parallel",
@@ -46,6 +46,7 @@
     "csp:check": "node scripts/check-csp-policy.mjs",
     "csp:verify": "node scripts/sync-csp.mjs && git diff --exit-code -- index.html nginx.conf public/_headers vercel.json src-tauri/tauri.conf.json && node scripts/check-csp-policy.mjs",
     "native-readiness:check": "node scripts/check-native-readiness.mjs",
+    "tauri-plugins:check": "node scripts/check-tauri-plugin-versions.mjs",
     "workflow-policy:check": "node scripts/workflow-policy-check.mjs",
     "pr-size:check": "node scripts/check-pr-size.mjs",
     "suppressions:check": "node scripts/check-suppressions.mjs",
@@ -142,8 +143,8 @@
     "@tauri-apps/api": "^2.11.1",
     "@tauri-apps/plugin-dialog": "^2.7.1",
     "@tauri-apps/plugin-fs": "^2.5.1",
-    "@tauri-apps/plugin-http": "^2.5.9",
-    "@tauri-apps/plugin-notification": "^2.3.3",
+    "@tauri-apps/plugin-http": "^2.6.0",
+    "@tauri-apps/plugin-notification": "^2.4.0",
     "@tauri-apps/plugin-process": "^2.3.1",
     "@tauri-apps/plugin-shell": "^2.3.5",
     "@tauri-apps/plugin-updater": "^2.11.0",
diff --git a/packages/desktop-contracts/package.json b/packages/desktop-contracts/package.json
index f670943fa..dc5db2439 100644
--- a/packages/desktop-contracts/package.json
+++ b/packages/desktop-contracts/package.json
@@ -12,7 +12,7 @@
     "@tauri-apps/api": "^2.11.1",
     "@tauri-apps/plugin-dialog": "^2.7.1",
     "@tauri-apps/plugin-fs": "^2.5.1",
-    "@tauri-apps/plugin-notification": "^2.3.3",
+    "@tauri-apps/plugin-notification": "^2.4.0",
     "@tauri-apps/plugin-process": "^2.3.1",
     "@tauri-apps/plugin-shell": "^2.3.5",
     "@tauri-apps/plugin-updater": "^2.11.0"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 226c4f915..db2d41f4c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -125,11 +125,11 @@ importers:
         specifier: ^2.5.1
         version: 2.5.1
       '@tauri-apps/plugin-http':
-        specifier: ^2.5.9
-        version: 2.5.9
+        specifier: ^2.6.0
+        version: 2.6.0
       '@tauri-apps/plugin-notification':
-        specifier: ^2.3.3
-        version: 2.3.3
+        specifier: ^2.4.0
+        version: 2.4.0
       '@tauri-apps/plugin-process':
         specifier: ^2.3.1
         version: 2.3.1
@@ -375,8 +375,8 @@ importers:
         specifier: ^2.5.1
         version: 2.5.1
       '@tauri-apps/plugin-notification':
-        specifier: ^2.3.3
-        version: 2.3.3
+        specifier: ^2.4.0
+        version: 2.4.0
       '@tauri-apps/plugin-process':
         specifier: ^2.3.1
         version: 2.3.1
@@ -3133,11 +3133,11 @@ packages:
   '@tauri-apps/plugin-fs@2.5.1':
     resolution: {integrity: sha512-9Lz+Jopp6QyeEWhlpkMx4R/+P9HgR+AVAI4vOZhlT8Xaymtz8iVI/Ov984/XTqgJz/5gz5NretqPB/XEMS3NhQ==}
 
-  '@tauri-apps/plugin-http@2.5.9':
-    resolution: {integrity: sha512-lCiY0+vs4HvIUSvZrBs8TC3TiCB0MOPRmiUjTq4prW7SlcJE2jdLeT6KBsJrT9Tlplufl7W1pY6SFAO3gCWxDA==}
+  '@tauri-apps/plugin-http@2.6.0':
+    resolution: {integrity: sha512-QYXwbGb4hQ9/8Riv/ejU/kPFFnbBIrBcWwV1LIXv2xBKfoj8lkWfGkd9pkCSsBI/pljPtz+IPqfrE3t3bVl3mg==}
 
-  '@tauri-apps/plugin-notification@2.3.3':
-    resolution: {integrity: sha512-Zw+ZH18RJb41G4NrfHgIuofJiymusqN+q8fGUIIV7vyCH+5sSn5coqRv/MWB9qETsUs97vmU045q7OyseCV3Qg==}
+  '@tauri-apps/plugin-notification@2.4.0':
+    resolution: {integrity: sha512-xlJXMcUoKOjNupzDue5wrEsa1wytf+l/2gCAPhafHyP683Y3N7J/8clUWLZ3vpnwkpT2C1zcLMMQFjjecIG2xg==}
 
   '@tauri-apps/plugin-process@2.3.1':
     resolution: {integrity: sha512-nCa4fGVaDL/B9ai03VyPOjfAHRHSBz5v6F/ObsB73r/dA3MHHhZtldaDMIc0V/pnUw9ehzr2iEG+XkSEyC0JJA==}
@@ -10613,11 +10613,11 @@ snapshots:
     dependencies:
       '@tauri-apps/api': 2.11.1
 
-  '@tauri-apps/plugin-http@2.5.9':
+  '@tauri-apps/plugin-http@2.6.0':
     dependencies:
       '@tauri-apps/api': 2.11.1
 
-  '@tauri-apps/plugin-notification@2.3.3':
+  '@tauri-apps/plugin-notification@2.4.0':
     dependencies:
       '@tauri-apps/api': 2.11.1
 
diff --git a/scripts/check-tauri-plugin-versions.d.mts b/scripts/check-tauri-plugin-versions.d.mts
new file mode 100644
index 000000000..f0de7ac02
--- /dev/null
+++ b/scripts/check-tauri-plugin-versions.d.mts
@@ -0,0 +1,7 @@
+export function resolvedCargoPluginVersions(cargoLock: string): Map<string, string | null>;
+export function resolvedPnpmImporterVersions(pnpmLock: string): Map<string, Map<string, string>>;
+export function findTauriPluginVersionMismatches(
+  cargoLock: string,
+  pnpmLock: string,
+  importerPackages: Array<{ importer: string; pkg: { dependencies?: Record<string, string> } }>,
+): string[];
diff --git a/scripts/check-tauri-plugin-versions.mjs b/scripts/check-tauri-plugin-versions.mjs
new file mode 100644
index 000000000..e24b80e38
--- /dev/null
+++ b/scripts/check-tauri-plugin-versions.mjs
@@ -0,0 +1,233 @@
+#!/usr/bin/env node
+/**
+ * Verify each Tauri plugin's Rust crate (src-tauri/Cargo.lock) and every workspace importer's
+ * coupled npm package (pnpm-lock.yaml resolved version, not the package.json declared range)
+ * share the same major.minor line.
+ * Run via ci:prepush or manually:
+ *   node scripts/check-tauri-plugin-versions.mjs
+ */
+// QNBS-v3: tauri build rejects this mismatch too, but only inside the slow, tag-triggered, cross-platform release workflow — mirrors that check cheaply for regular CI (found live: v1.28.5's Rust-only plugin bump via #661 broke every platform's release build).
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = path.join(__dirname, '..');
+
+const cargoLockPath = path.join(root, 'src-tauri', 'Cargo.lock');
+const pnpmLockPath = path.join(root, 'pnpm-lock.yaml');
+const rootPkgPath = path.join(root, 'package.json');
+const packagesDir = path.join(root, 'packages');
+
+// QNBS-v3 (codex): tauri-plugin-log, -window-state, and -deep-link all have real @tauri-apps/plugin-* npm packages too (verified against the npm registry) even though this repo doesn't declare them in package.json yet — listed here so the guard covers them immediately if that ever changes. Only tauri-plugin-single-instance genuinely has no npm counterpart (confirmed 404).
+const PLUGIN_CRATE_NAMES = [
+  'tauri-plugin-deep-link',
+  'tauri-plugin-dialog',
+  'tauri-plugin-fs',
+  'tauri-plugin-http',
+  'tauri-plugin-log',
+  'tauri-plugin-notification',
+  'tauri-plugin-process',
+  'tauri-plugin-shell',
+  'tauri-plugin-updater',
+  'tauri-plugin-window-state',
+];
+const crateToNpmName = (crateName) => `@tauri-apps/${crateName.replace(/^tauri-/, '')}`;
+
+function normalizeLineEndings(text) {
+  return text.replace(/\r\n/g, '\n');
+}
+
+// QNBS-v3: only the exact leading semver (2.6.0) is kept — a resolved lockfile version can carry a trailing "(patch_hash=...)" or peer-suffix annotation that must not corrupt the comparison.
+function majorMinor(version) {
+  const match = version.match(/^(\d+)\.(\d+)\.\d+/);
+  return match ? `${match[1]}.${match[2]}` : null;
+}
+
+// QNBS-v3 (cubic): Cargo.lock qualifies a same-named dependency as "name version" inside its owning package's own dependencies list only when more than one resolved version of that crate exists — reading this authoritative signal avoids ever mistaking a transitive occurrence for the direct app dependency.
+function directDependencyReferences(cargoLock) {
+  const ownPackageMatch = cargoLock.match(
+    /name = "worldscript-studio"\n(?:[^\n]*\n)*?dependencies = \[\n([^\]]*)\]/,
+  );
+  const references = new Map();
+  if (!ownPackageMatch) return references;
+  for (const line of ownPackageMatch[1].split('\n')) {
+    const depMatch = line.match(/"([^"]+)"/);
+    if (!depMatch) continue;
+    const [name, version] = depMatch[1].split(' ');
+    references.set(name, version ?? null);
+  }
+  return references;
+}
+
+function allResolvedVersionsOf(cargoLock, crateName) {
+  const regex = new RegExp(`name = "${crateName}"\\nversion = "([^"]+)"`, 'g');
+  const versions = [];
+  for (const match of cargoLock.matchAll(regex)) versions.push(match[1]);
+  return versions;
+}
+
+// QNBS-v3 (CodeScene): extracted so resolvedCargoPluginVersions stays a flat loop of early returns instead of nested branches — undefined means "not a direct dependency at all", null means "ambiguous/inconsistent", a string is the confirmed resolved version.
+function resolveCrateVersion(crateName, references, normalized) {
+  // QNBS-v3 (codex): a crate absent from worldscript-studio's own dependencies list is at most a transitive occurrence, even with only one lockfile entry — routing it through the existing "no resolved version" fail-closed path instead of comparing an unrelated transitive version.
+  if (!references.has(crateName)) return undefined;
+  const versions = allResolvedVersionsOf(normalized, crateName);
+  const qualifiedVersion = references.get(crateName);
+  if (!qualifiedVersion) {
+    if (versions.length === 1) return versions[0];
+    if (versions.length > 1) return null;
+    return undefined;
+  }
+  // QNBS-v3 (cubic): a qualified reference not matched by any actual [[package]] entry means the lockfile itself is inconsistent — trust only a reference that a real resolved entry confirms.
+  if (versions.includes(qualifiedVersion)) return qualifiedVersion;
+  return versions.length > 0 ? null : undefined;
+}
+
+// QNBS-v3: a crate absent from the returned map has no resolved version at all; a crate mapped to null was found more than once in Cargo.lock with no disambiguating reference — both are distinct fail-closed states, never guessed.
+export function resolvedCargoPluginVersions(cargoLock) {
+  const normalized = normalizeLineEndings(cargoLock);
+  const references = directDependencyReferences(normalized);
+  const resolved = new Map();
+  for (const crateName of PLUGIN_CRATE_NAMES) {
+    const version = resolveCrateVersion(crateName, references, normalized);
+    if (version !== undefined) resolved.set(crateName, version);
+  }
+  return resolved;
+}
+
+function importerHeaderName(line) {
+  const match = line.match(/^ {2}(\S.*):$/);
+  return match ? match[1] : null;
+}
+
+function importerPackageName(line) {
+  const match = line.match(/^ {6}'?(@[\w.-]+\/[\w.-]+|[\w.-]+)'?:$/);
+  return match ? match[1] : null;
+}
+
+function importerPackageVersion(line) {
+  const match = line.match(/^ {8}version: (.+)$/);
+  return match ? match[1].trim() : null;
+}
+
+// QNBS-v3: line-based state-machine parse (importer header at 2-space indent, package name at 6-space, specifier/version at 8-space) — pnpm-lock.yaml's importers block is regular enough that this avoids adding a YAML-parsing dependency.
+export function resolvedPnpmImporterVersions(pnpmLock) {
+  const lines = normalizeLineEndings(pnpmLock).split('\n');
+  const byImporter = new Map();
+  let currentImporter = null;
+  let currentPackage = null;
+  for (const line of lines) {
+    const importer = importerHeaderName(line);
+    if (importer) {
+      currentImporter = importer;
+      currentPackage = null;
+      if (!byImporter.has(importer)) byImporter.set(importer, new Map());
+      continue;
+    }
+    const packageName = importerPackageName(line);
+    if (packageName) {
+      currentPackage = packageName;
+      continue;
+    }
+    const version = importerPackageVersion(line);
+    if (!version) continue;
+    if (!currentImporter) continue;
+    if (!currentPackage) continue;
+    byImporter.get(currentImporter).set(currentPackage, version);
+  }
+  return byImporter;
+}
+
+// QNBS-v3: reads package.json for every workspace member from disk — kept separate from the pure comparison function below so that one stays fully unit-testable without touching the filesystem.
+function discoverWorkspaceImporterPackages() {
+  const importerPackages = [
+    { importer: '.', pkg: JSON.parse(fs.readFileSync(rootPkgPath, 'utf8')) },
+  ];
+  if (!fs.existsSync(packagesDir)) return importerPackages;
+  for (const entry of fs.readdirSync(packagesDir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    const pkgJsonPath = path.join(packagesDir, entry.name, 'package.json');
+    if (!fs.existsSync(pkgJsonPath)) continue;
+    importerPackages.push({
+      importer: `packages/${entry.name}`,
+      pkg: JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8')),
+    });
+  }
+  return importerPackages;
+}
+
+// QNBS-v3 (CodeScene): extracted so findTauriPluginVersionMismatches stays a flat loop — returns a finding string for one declared pair, or null when it's aligned.
+function checkPluginPairParity(importer, crateName, cargoVersions, importerVersions) {
+  const npmName = crateToNpmName(crateName);
+  if (!cargoVersions.has(crateName)) {
+    return `${importer}: ${npmName} is declared but ${crateName} has no resolved version in Cargo.lock — fix Cargo.lock before this check can validate parity`;
+  }
+  const rustVersion = cargoVersions.get(crateName);
+  if (rustVersion === null) {
+    return `${importer}: ${npmName} is declared but ${crateName} resolves to more than one version in Cargo.lock with no disambiguating direct-dependency reference — fix Cargo.lock before this check can validate parity`;
+  }
+  const npmVersion = importerVersions?.get(npmName);
+  if (!npmVersion) {
+    return `${importer}: ${npmName} is declared but has no resolved version in pnpm-lock.yaml for this importer — reconcile the lockfile before this check can validate parity`;
+  }
+  const rustMM = majorMinor(rustVersion);
+  if (!rustMM)
+    return `${importer}: ${crateName}'s resolved Rust version "${rustVersion}" is not a parseable semver`;
+  const npmMM = majorMinor(npmVersion);
+  if (!npmMM)
+    return `${importer}: ${npmName}'s resolved npm version "${npmVersion}" is not a parseable semver`;
+  if (rustMM !== npmMM) {
+    return `${importer}: ${crateName} (Rust ${rustVersion}) vs ${npmName} (npm ${npmVersion}, resolved) — major.minor mismatch, "pnpm exec tauri build" rejects this`;
+  }
+  return null;
+}
+
+// QNBS-v3 (codex): a plugin declared under optionalDependencies/peerDependencies/devDependencies still resolves into the lockfile and can still be bundled — checking only "dependencies" silently skipped it.
+const DEPENDENCY_SECTIONS = [
+  'dependencies',
+  'optionalDependencies',
+  'peerDependencies',
+  'devDependencies',
+];
+
+function isDeclaredInAnySection(pkg, npmName) {
+  return DEPENDENCY_SECTIONS.some((section) => Boolean(pkg[section]?.[npmName]));
+}
+
+function declaredPluginCrateNames(pkg) {
+  return PLUGIN_CRATE_NAMES.filter((crateName) =>
+    isDeclaredInAnySection(pkg, crateToNpmName(crateName)),
+  );
+}
+
+export function findTauriPluginVersionMismatches(cargoLock, pnpmLock, importerPackages) {
+  const cargoVersions = resolvedCargoPluginVersions(cargoLock);
+  const pnpmVersions = resolvedPnpmImporterVersions(pnpmLock);
+
+  return importerPackages.flatMap(({ importer, pkg }) => {
+    const importerVersions = pnpmVersions.get(importer);
+    return declaredPluginCrateNames(pkg)
+      .map((crateName) =>
+        checkPluginPairParity(importer, crateName, cargoVersions, importerVersions),
+      )
+      .filter((finding) => finding !== null);
+  });
+}
+
+function main() {
+  const cargoLock = fs.readFileSync(cargoLockPath, 'utf8');
+  const pnpmLock = fs.readFileSync(pnpmLockPath, 'utf8');
+  const importerPackages = discoverWorkspaceImporterPackages();
+  const findings = findTauriPluginVersionMismatches(cargoLock, pnpmLock, importerPackages);
+  if (findings.length > 0) {
+    process.stderr.write(
+      `[tauri-plugin-versions] MISMATCH — ${findings.length} finding(s):\n${findings.map((f) => `  - ${f}`).join('\n')}\n`,
+    );
+    process.exit(1);
+  }
+  process.stdout.write(
+    `[tauri-plugin-versions] OK — ${importerPackages.length} workspace importer(s) checked against resolved lockfile versions, all major.minor-aligned.\n`,
+  );
+}
+
+if (path.resolve(process.argv[1] ?? '') === fileURLToPath(import.meta.url)) main();
diff --git a/scripts/ci-prepush-lowend.mjs b/scripts/ci-prepush-lowend.mjs
index a65fe344f..a26db12c9 100644
--- a/scripts/ci-prepush-lowend.mjs
+++ b/scripts/ci-prepush-lowend.mjs
@@ -84,6 +84,9 @@ async function main() {
     runNodeScript('scripts/check-tauri-import-boundary.mjs'),
   );
   await runCheck('Native readiness', () => runNodeScript('scripts/check-native-readiness.mjs'));
+  await runCheck('Tauri plugin version parity', () =>
+    runNodeScript('scripts/check-tauri-plugin-versions.mjs'),
+  );
 
   if (shouldRunAdmissionCheck('i18n', classification.files) || full) {
     await runCheck('i18n key parity', () => runNodeScript('scripts/check-i18n-keys.mjs'));
diff --git a/tests/unit/checkTauriPluginVersions.test.ts b/tests/unit/checkTauriPluginVersions.test.ts
new file mode 100644
index 000000000..4d04732d4
--- /dev/null
+++ b/tests/unit/checkTauriPluginVersions.test.ts
@@ -0,0 +1,284 @@
+// @vitest-environment node
+import { describe, expect, it } from 'vitest';
+import {
+  findTauriPluginVersionMismatches,
+  resolvedCargoPluginVersions,
+  resolvedPnpmImporterVersions,
+} from '../../scripts/check-tauri-plugin-versions.mjs';
+
+function cargoLockEntry(crateName: string, version: string): string {
+  return `[[package]]\nname = "${crateName}"\nversion = "${version}"\nsource = "registry+https://github.com/rust-lang/crates.io-index"\n`;
+}
+
+// QNBS-v3: mirrors how Cargo.lock disambiguates a same-named dependency as "name version" inside the owning package's own dependencies list only when more than one resolved version exists.
+function ownPackageBlock(dependencyRefs: string[]): string {
+  const refLines = dependencyRefs.map((ref) => ` "${ref}",`).join('\n');
+  return `[[package]]\nname = "worldscript-studio"\nversion = "1.28.5"\ndependencies = [\n${refLines}\n]\n`;
+}
+
+function pnpmImporterBlock(
+  importer: string,
+  pkgs: Record<string, { specifier: string; version: string }>,
+): string {
+  const lines = [`  ${importer}:`, '    dependencies:'];
+  for (const [name, { specifier, version }] of Object.entries(pkgs)) {
+    lines.push(
+      `      '${name}':`,
+      `        specifier: ${specifier}`,
+      `        version: ${version}`,
+    );
+  }
+  return `${lines.join('\n')}\n`;
+}
+
+function importerPkg(importer: string, dependencies: Record<string, string>) {
+  return { importer, pkg: { dependencies } };
+}
+
+function importerPkgWithSection(
+  importer: string,
+  section: 'optionalDependencies' | 'peerDependencies' | 'devDependencies',
+  deps: Record<string, string>,
+) {
+  return { importer, pkg: { [section]: deps } };
+}
+
+describe('resolvedCargoPluginVersions', () => {
+  it('resolves a plugin crate version from Cargo.lock', () => {
+    const cargoLock =
+      ownPackageBlock(['tauri-plugin-http']) + cargoLockEntry('tauri-plugin-http', '2.6.0');
+    const versions = resolvedCargoPluginVersions(cargoLock);
+    expect(versions.get('tauri-plugin-http')).toBe('2.6.0');
+  });
+
+  // QNBS-v3: a Windows checkout without a pinned EOL for Cargo.lock can convert it to CRLF; the literal \n in the matcher must not silently stop matching.
+  it('resolves a plugin crate version from a CRLF-line-ended Cargo.lock', () => {
+    const cargoLock =
+      ownPackageBlock(['tauri-plugin-http']) + cargoLockEntry('tauri-plugin-http', '2.6.0');
+    const versions = resolvedCargoPluginVersions(cargoLock.replace(/\n/g, '\r\n'));
+    expect(versions.get('tauri-plugin-http')).toBe('2.6.0');
+  });
+
+  // QNBS-v3 (cubic): three ways the same two-entry duplicate Cargo.lock can be resolved, table-driven — a matching qualified reference disambiguates it, no reference at all is genuinely ambiguous, and a reference pointing nowhere real is an inconsistent lockfile. All three must fail closed except the first.
+  it.each([
+    {
+      name: 'a qualified reference matching an existing entry',
+      ref: 'tauri-plugin-http 2.6.0',
+      expected: '2.6.0',
+    },
+    { name: 'no disambiguating reference at all', ref: 'tauri-plugin-http', expected: null },
+    {
+      name: 'a qualified reference matching no entry',
+      ref: 'tauri-plugin-http 2.7.0',
+      expected: null,
+    },
+  ])('resolves a duplicate-entry Cargo.lock correctly for $name', ({ ref, expected }) => {
+    const cargoLock =
+      ownPackageBlock([ref]) +
+      cargoLockEntry('tauri-plugin-http', '2.5.0') + // transitive, textually first
+      cargoLockEntry('tauri-plugin-http', '2.6.0'); // direct, referenced by name
+    const versions = resolvedCargoPluginVersions(cargoLock);
+    expect(versions.get('tauri-plugin-http') ?? null).toEqual(expected);
+  });
+
+  // QNBS-v3 (codex): a crate with only one lockfile entry is not necessarily a direct app dependency — it can be pulled in solely as a transitive of another plugin (e.g. tauri-plugin-deep-link via single-instance's "deep-link" feature). Absent from the direct-dependencies list, it must not be treated as resolved at all.
+  it('does not resolve a crate that has only one lockfile entry but is absent from the direct-dependencies list', () => {
+    const cargoLock =
+      ownPackageBlock(['tauri-plugin-dialog']) + // http is NOT listed as a direct dependency here
+      cargoLockEntry('tauri-plugin-http', '2.6.0'); // present only as a transitive occurrence
+    const versions = resolvedCargoPluginVersions(cargoLock);
+    expect(versions.has('tauri-plugin-http')).toBe(false);
+  });
+});
+
+describe('resolvedPnpmImporterVersions', () => {
+  it('resolves the actual locked version, not the declared specifier range', () => {
+    const lock = pnpmImporterBlock('.', {
+      '@tauri-apps/plugin-http': { specifier: '^2.6.0', version: '2.6.3' },
+    });
+    const byImporter = resolvedPnpmImporterVersions(lock);
+    expect(byImporter.get('.')?.get('@tauri-apps/plugin-http')).toBe('2.6.3');
+  });
+
+  it('keeps each importer’s resolved versions independent', () => {
+    const lock =
+      pnpmImporterBlock('.', {
+        '@tauri-apps/plugin-notification': { specifier: '^2.4.0', version: '2.4.0' },
+      }) +
+      pnpmImporterBlock('packages/desktop-contracts', {
+        '@tauri-apps/plugin-notification': { specifier: '^2.3.3', version: '2.3.3' },
+      });
+    const byImporter = resolvedPnpmImporterVersions(lock);
+    expect(byImporter.get('.')?.get('@tauri-apps/plugin-notification')).toBe('2.4.0');
+    expect(
+      byImporter.get('packages/desktop-contracts')?.get('@tauri-apps/plugin-notification'),
+    ).toBe('2.3.3');
+  });
+});
+
+describe('findTauriPluginVersionMismatches', () => {
+  // QNBS-v3: consolidates two previously-separate "no finding" cases (a straightforwardly aligned pair, and a resolved version that has moved past its declared specifier) into one table.
+  it.each([
+    {
+      name: 'an aligned pair',
+      crate: 'tauri-plugin-http',
+      rust: '2.6.0',
+      npm: '@tauri-apps/plugin-http',
+      specifier: '^2.6.0',
+      resolved: '2.6.3',
+    },
+    {
+      name: 'a resolved version ahead of its specifier',
+      crate: 'tauri-plugin-updater',
+      rust: '2.11.0',
+      npm: '@tauri-apps/plugin-updater',
+      specifier: '^2.9.0',
+      resolved: '2.11.4',
+    },
+  ])('reports nothing for $name', ({ crate, rust, npm, specifier, resolved }) => {
+    const cargoLock = ownPackageBlock([crate]) + cargoLockEntry(crate, rust);
+    const pnpmLock = pnpmImporterBlock('.', { [npm]: { specifier, version: resolved } });
+    const findings = findTauriPluginVersionMismatches(cargoLock, pnpmLock, [
+      importerPkg('.', { [npm]: specifier }),
+    ]);
+    expect(findings).toEqual([]);
+  });
+
+  it('flags a Rust-ahead-of-npm minor-version mismatch, reproducing the v1.28.5 release failure', () => {
+    const cargoLock =
+      ownPackageBlock(['tauri-plugin-http', 'tauri-plugin-notification']) +
+      cargoLockEntry('tauri-plugin-http', '2.6.0') +
+      cargoLockEntry('tauri-plugin-notification', '2.4.0');
+    const pnpmLock = pnpmImporterBlock('.', {
+      '@tauri-apps/plugin-http': { specifier: '^2.5.9', version: '2.5.9' },
+      '@tauri-apps/plugin-notification': { specifier: '^2.3.3', version: '2.3.3' },
+    });
+    const findings = findTauriPluginVersionMismatches(cargoLock, pnpmLock, [
+      importerPkg('.', {
+        '@tauri-apps/plugin-http': '^2.5.9',
+        '@tauri-apps/plugin-notification': '^2.3.3',
+      }),
+    ]);
+    expect(findings).toHaveLength(2);
+    expect(findings[0]).toContain('major.minor mismatch');
+    expect(findings[0]).toContain('tauri-plugin-http');
+    expect(findings[1]).toContain('major.minor mismatch');
+    expect(findings[1]).toContain('tauri-plugin-notification');
+  });
+
+  // QNBS-v3: reproduces the exact reviewer-found gap — root package.json/lockfile were fixed, but a workspace member's own manifest still resolved the stale minor.
+  it('flags a workspace-member importer drifting independently of the root', () => {
+    const cargoLock =
+      ownPackageBlock(['tauri-plugin-notification']) +
+      cargoLockEntry('tauri-plugin-notification', '2.4.0');
+    const pnpmLock =
+      pnpmImporterBlock('.', {
+        '@tauri-apps/plugin-notification': { specifier: '^2.4.0', version: '2.4.0' },
+      }) +
+      pnpmImporterBlock('packages/desktop-contracts', {
+        '@tauri-apps/plugin-notification': { specifier: '^2.3.3', version: '2.3.3' },
+      });
+    const findings = findTauriPluginVersionMismatches(cargoLock, pnpmLock, [
+      importerPkg('.', { '@tauri-apps/plugin-notification': '^2.4.0' }),
+      importerPkg('packages/desktop-contracts', { '@tauri-apps/plugin-notification': '^2.3.3' }),
+    ]);
+    expect(findings).toHaveLength(1);
+    expect(findings[0]).toContain('major.minor mismatch');
+    expect(findings[0]).toContain('packages/desktop-contracts');
+    expect(findings[0]).toContain('@tauri-apps/plugin-notification');
+  });
+
+  // QNBS-v3 (CodeScene): unifies six single-'.'-importer, single-http-crate scenarios (each previously its own near-identical test) into one table — every distinct code path (no direct Rust dependency, non-"dependencies" section, undisambiguated duplicate, correctly-disambiguated duplicate, missing Cargo.lock entry, missing pnpm-lock.yaml entry) stays independently named and asserted, just without repeating the same four-line "build lockfiles, call, assert" shape six times.
+  it.each([
+    {
+      name: 'no direct Rust dependency, only a transitive one',
+      cargoLock:
+        ownPackageBlock(['tauri-plugin-dialog']) + cargoLockEntry('tauri-plugin-http', '2.6.0'),
+      pnpmLock: pnpmImporterBlock('.', {
+        '@tauri-apps/plugin-http': { specifier: '^2.6.0', version: '2.6.0' },
+      }),
+      importerPackages: [importerPkg('.', { '@tauri-apps/plugin-http': '^2.6.0' })],
+      expectedSubstrings: ['no resolved version in Cargo.lock'],
+    },
+    {
+      // QNBS-v3 (codex): a plugin declared under optionalDependencies/peerDependencies/devDependencies still resolves into the lockfile and can still be bundled — checking only "dependencies" silently skipped it.
+      name: 'a plugin declared under a non-"dependencies" section',
+      cargoLock:
+        ownPackageBlock(['tauri-plugin-http']) + cargoLockEntry('tauri-plugin-http', '2.5.0'),
+      pnpmLock: pnpmImporterBlock('.', {
+        '@tauri-apps/plugin-http': { specifier: '^2.6.0', version: '2.6.0' },
+      }),
+      importerPackages: [
+        importerPkgWithSection('.', 'optionalDependencies', {
+          '@tauri-apps/plugin-http': '^2.6.0',
+        }),
+      ],
+      expectedSubstrings: ['major.minor mismatch'],
+    },
+    {
+      name: 'an undisambiguated Cargo.lock duplicate, rather than guessing',
+      cargoLock:
+        ownPackageBlock(['tauri-plugin-http']) +
+        cargoLockEntry('tauri-plugin-http', '2.5.0') +
+        cargoLockEntry('tauri-plugin-http', '2.6.0'),
+      pnpmLock: pnpmImporterBlock('.', {
+        '@tauri-apps/plugin-http': { specifier: '^2.6.0', version: '2.6.3' },
+      }),
+      importerPackages: [importerPkg('.', { '@tauri-apps/plugin-http': '^2.6.0' })],
+      expectedSubstrings: ['more than one version'],
+    },
+    {
+      // QNBS-v3 (cubic): a duplicate Cargo.lock entry must resolve to the direct app dependency's version (2.6.0), never the textually-first transitive occurrence (2.5.0) — proven by zero findings, since using the wrong one would falsely flag this as a mismatch.
+      name: 'nothing, correctly disambiguating a duplicate Cargo.lock entry via the direct reference',
+      cargoLock:
+        ownPackageBlock(['tauri-plugin-http 2.6.0']) +
+        cargoLockEntry('tauri-plugin-http', '2.5.0') +
+        cargoLockEntry('tauri-plugin-http', '2.6.0'),
+      pnpmLock: pnpmImporterBlock('.', {
+        '@tauri-apps/plugin-http': { specifier: '^2.6.0', version: '2.6.3' },
+      }),
+      importerPackages: [importerPkg('.', { '@tauri-apps/plugin-http': '^2.6.0' })],
+      expectedSubstrings: [],
+    },
+    {
+      // QNBS-v3: fail closed — a plugin declared in package.json with no resolved Cargo.lock entry means the lockfile is out of sync and parity cannot be verified, which must surface as a finding, not a silent pass.
+      name: 'no resolved Rust crate version at all',
+      cargoLock: '',
+      pnpmLock: pnpmImporterBlock('.', {
+        '@tauri-apps/plugin-http': { specifier: '^2.6.0', version: '2.6.0' },
+      }),
+      importerPackages: [importerPkg('.', { '@tauri-apps/plugin-http': '^2.6.0' })],
+      expectedSubstrings: ['no resolved version in Cargo.lock'],
+    },
+    {
+      name: 'no resolved npm version in the lockfile',
+      cargoLock:
+        ownPackageBlock(['tauri-plugin-http']) + cargoLockEntry('tauri-plugin-http', '2.6.0'),
+      pnpmLock: pnpmImporterBlock('.', {}), // http declared in package.json but absent from the lockfile importer
+      importerPackages: [importerPkg('.', { '@tauri-apps/plugin-http': '^2.6.0' })],
+      expectedSubstrings: ['no resolved version in pnpm-lock.yaml'],
+    },
+  ])('flags $name', ({ cargoLock, pnpmLock, importerPackages, expectedSubstrings }) => {
+    const findings = findTauriPluginVersionMismatches(cargoLock, pnpmLock, importerPackages);
+    expect(findings).toHaveLength(expectedSubstrings.length);
+    expectedSubstrings.forEach((substring, index) => {
+      expect(findings[index]).toContain(substring);
+    });
+  });
+
+  it('skips a plugin the importer does not declare at all (not applicable, not a failure)', () => {
+    // QNBS-v3: http has no Cargo.lock entry at all here, proving it was never even considered for an importer that doesn't declare it — only notification (declared, and given a matching Cargo entry) is checked.
+    const cargoLock =
+      ownPackageBlock(['tauri-plugin-notification']) +
+      cargoLockEntry('tauri-plugin-notification', '2.4.0');
+    const pnpmLock = pnpmImporterBlock('packages/desktop-contracts', {
+      '@tauri-apps/plugin-notification': { specifier: '^2.4.0', version: '2.4.0' },
+    });
+    const findings = findTauriPluginVersionMismatches(cargoLock, pnpmLock, [
+      importerPkg('packages/desktop-contracts', {
+        '@tauri-apps/plugin-notification': '^2.4.0',
+      }),
+    ]);
+    expect(findings).toEqual([]);
+  });
+});